定义 JSON 策略文件

此处提供了样本 JSON 策略文件。 将 <...> 占位符替换为实际值。

• 要在其上运行的代理程序作业是使用 target 块定义的。
• 用于选择要在代理程序上运行的工作空间或操作的属性由 parameter 块定义。

可以在任何编辑器或 IDE 中编辑策略 JSON 文件。 它们必须是有效的JSON。

策略 JSON 文件语法:

  {
      "target": {
      "selector_kind": "ids",
      "selector_ids": [
        "<agent id>"
      ]
    },
    "parameter": {
      "agent_assignment_policy_parameter": {
        "selector_kind": "scoped",
        "selector_scope": [{
          "kind": "workspace",
          "tags": [
            "<user_tag>"
          ],
          "resource_groups": [
            "<resource_group>"
          ],
          "locations": [
            "<region>"
          ]
        }]
      }
    }
  }

示例

  {
      "target": {
      "selector_kind": "ids",
      "selector_ids": [
        "agent-prod-live.deA.e055"
      ]
    },
    "parameter": {
      "agent_assignment_policy_parameter": {
        "selector_kind": "scoped",
        "selector_scope": [{
          "kind": "workspace",
          "tags": [
            "live-prod"
          ],
          "resource_groups": [
            "Default"
          ],
          "locations": [
            "eu-de"
          ]
        }]
      }
    }
  }

创建代理程序策略

示例

ibmcloud schematics policy create --name agent-policy-testing-cli-jan-10 --kind agent_assignment_policy --location eu-de --resource-group Default --target-file policy.json

输出

Creating policy...

ID               agent-policy-testing-cli-jan-10.deP.c737   
Name             agent-policy-testing-cli-jan-10-27   
Description         
Kind             agent_assignment_policy   
Location         eu-de   
Resource Group   aac37f57b20142dba1a435c70aeb12df   
Target              
Tags             [TAGS]   
                  - workspace-policy:prod

使用 API 创建策略的示例

POST /v2/settings/policies HTTP/1.1
Host: schematics.cloud.ibm.com
Content-Type: application/json
Authorization: Bearer <auth_token>
{
    "name": "policy-1",
    "description": "Policy for job execution of secured workspaces on agent1",
    "resource_group": "Default",
    "tags": [
      "policy:secured-job"
    ],
    "location": "us-south",
    "kind": "agent_assignment_policy",
    "target": {
      "selector_kind": "ids",
      "selector_ids": [
        "agent5.8442"
      ]
    },
    "parameter": {
      "agent_assignment_policy_parameter": {
        "selector_kind": "scoped",
        "selector_scope": [
          {
            "kind": "workspace",
            "tags": [
              "env:dev",
              "k8s"
            ],
            "resource_groups": [
              "test"
            ],
            "locations": [
              "us-south"
            ]
          }
        ]
      }
    }
  }

使用 API 获取策略的示例

GET /v2/settings/policies/<your policy_id> HTTP/1.1
Host: schematics.cloud.ibm.com
Content-Type: application/json
X-ENABLE-POLICIES: true
Authorization: Bearer <auth_token>

使用 API 更新策略的示例

PATCH /v2/settings/policies/<your policy_id> HTTP/1.1
Host: schematics.cloud.ibm.com
Content-Type: application/json
X-ENABLE-POLICIES: true
Authorization: Bearer <auth_token>
{
    "name": "policy-1",
    "description": "updated Policy for job execution of secured workspaces on agent1",
    "resource_group": "Default",
    "tags": [
      "policy:secured-job"
    ],
    "location": "us-south",
    "kind": "agent_assignment_policy",
    "target": {
      "selector_kind": "ids",
      "selector_ids": [
        "agent5.13a6"
      ]
    },
    "parameter": {
      "agent_assignment_policy_parameter": {
        "selector_kind": "scoped",
        "selector_scope": [
          {
            "kind": "action",
            "tags": [
              "env:dev",
              "k8s"
            ],
            "resource_groups": [
              "dummy_resource_group"
            ],
            "locations": [
              "us-south"
            ]
          }
        ]
      }
    }
  }

使用 API 查找策略的示例

POST /v2/settings/policies/search HTTP/1.1
Host: schematics.cloud.ibm.com
Content-Type: application/json
Authorization: Bearer <auth_token>
{
   "parameter": {
            "kind": "workspace",
            "tags": [
              "env:dev",
              "k8s"
            ],
            "resource_groups": [
              "test"
            ],
            "locations": [
              "us-south"
            ]
          },
    "target": "action"
  }

现在，您可以使用代理程序来运行 Schematics Terraform 或 Ansible 作业。 代理程序针对与定义的选择策略参数匹配的工作空间或操作执行任何作业:

• 资源组
• 位置
• 标记

请注意，必须在工作空间或操作创建时设置标记。 在策略评估期间，不会检测或考虑通过 Schematics UI 对标记执行的任何更改。

执行后，工作空间或操作作业日志包含一个头，该头指示在其上执行作业的代理程序。

2023/04/08 15:22:07 -----  New Workspace Action  -----
2023/04/08 15:22:07 Request: activitId=e3fcfdfdb13b07a1c60176e4b95c41ba, account=, owner=steve_strutt@uk.ibm.com, requestID=0a8a3428-b461-4dd0-8104-e859d68d35f6, OrchestratorID=orchestrator-5c8585dc74-6z9s5, agentID=agent-test-da.deA.e055, agentName=agent-test-da, jobRunnerID=jobrunner-5d99b5cfb7-p5xcz
2023/04/08 15:22:07 Related Workspace: name=myworkspace, agentID=agent-test-da.deA.e055 sourcerelease=(not specified), sourceurl=https://github.com/stevestrutt/multitier-vpc-bastion-host, branch=(not specified), folder=.
2023/04/08 15:22:07  --- Ready to execute the command on Agent agent-test-da.deA.e055 ---